Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

An argument was made about reducing the potential attack surface.

How many big-endian systems can you currently point out in your environment? How often do you use X11 forwarding? What's the intersection of these two sets?

Even if you somehow do have even one such system, you're pitting that incredibly niche use case against the security of literally every single other X11 user on the planet, which is easily millions.

They 100% did the right thing.



I haven't dug through the X server code, but byte-swapping ought to be an insignificant attack surface of the code. Most network protocols do this already; ssh does it!

The only thing that matches with what I have observed from the X developers is that the X code is, in general, a steaming pile of shit that nobody wants to wade through anymore and so any bit that can be disabled and/or removed is unambiguously a Good Thing. The design of Wayland strongly implies that network transparency is a non-feature for the X developers, so everything surrounding it will be a target for removal.


The problem with the X server code is most of the protocol code is very complex and it's hand rolled code predating C89. It (still!) does all the parsing and byte swaps manually. In a modern project you would have the compiler generate the parsers and the dispatch table based on an IDL but X is way too old to have done this. There are just two implementations in the code for everything. No one wants to touch it due to fear of breaking everything even worse. So instead they just slowly try to stop the bleeding by disabling things that cause the worst security issues. It's a bad situation overall, and the time has already passed for a full rewrite of the X server to be viable.

The SSH protocol is relatively simple by comparison, and most importantly, there actually are multiple independent modernized implementations of it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: